<div dir="ltr"><div>PCI spec is pretty clear you're to have separation (virtual/physical) between PCI and other environments.</div><div><br></div><div>OTOH, TPG SLA's do not require TLS1.0+.</div><div><br></div><div>Someone is going to have to sling for an external MTA.</div><div><br></div><div>Kind regards</div><div><br></div><div>Paul Wilkins<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 23 July 2018 at 16:01, Michael Junek <span dir="ltr"><<a href="mailto:michael@juneks.com.au" target="_blank">michael@juneks.com.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:#000000;background-color:#ffffff;font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Just being the 'mean security consultant' - the security level of each system could easily be argued - email would be considered low security for compatibility (which technically means that TLS1.0/SSL3 etc is acceptable) ; whereas the web servers are considered
high security handling CHD, which means that they should covered under the full encrypted spec. It would also mean if that was considered, that 2.2.1 would apply, and seperation of function would be required.<br>
</p>
<p><br>
</p>
<p><br>
</p>
<div style="color:rgb(33,33,33)">
<hr style="display:inline-block;width:98%">
<div id="m_3484836868209194876divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Bradley Silverman <<a href="mailto:bsilverman@staff.ventraip.com" target="_blank">bsilverman@staff.ventraip.com</a><wbr>><br>
<b>Sent:</b> Monday, 23 July 2018 15:56<br>
<b>To:</b> Michael Junek<br>
<b>Cc:</b> Mark Newton; <a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a><div><div class="h5"><br>
<b>Subject:</b> Re: [AusNOG] Issues receiving from TPG Mail servers.</div></div></font>
<div> </div>
</div><div><div class="h5">
<div>
<div dir="ltr">@Michael - That's what we are looking at doing, though it will be a pain. Not sure how to go about doing it with Exim & cPanel but will start looking into it.
<div><br>
</div>
<div>Re 2.2.1, it won't fail if they have the same security level, which is what we are trying to accomplish by bringing TPG into spec. DNS is on separate servers, and the database connection isn't publicly accessible.</div>
<div><br>
</div>
<div>Really appreciate the help with this gents. Hopefully TPG get back in touch with me else we will have to investigate ways of blocking TLS handshakes from TPG.</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_3484836868209194876gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">Regards,
<div><br>
</div>
<div>Bradley Silverman | VentraIP Australia<br>
<b>Technical Operations</b><br>
<br>
mobile. +61 418 641 103<br>
phone. +61 3 9013 8464<br>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Mon, Jul 23, 2018 at 3:48 PM, Michael Junek <span dir="ltr">
<<a href="mailto:michael@juneks.com.au" target="_blank">michael@juneks.com.au</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:#000000;background-color:#ffffff;font-family:Calibri,Arial,Helvetica,sans-serif">
<p>On the PCI Audit side of things, however, I think the shared hosting such as CPanel servers will fail PCI based on requirement 2.2.1 regardless--</p>
<p><br>
</p>
<p>"</p>
<p>Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)</p>
<p>"<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div style="color:rgb(33,33,33)"><span>
<hr style="display:inline-block;width:98%">
<div id="m_3484836868209194876m_-3072269293863601540divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net" target="_blank">ausnog-bounces@lists.ausnog.n<wbr>et</a>> on
behalf of Bradley Silverman <<a href="mailto:bsilverman@staff.ventraip.com" target="_blank">bsilverman@staff.ventraip.com</a><wbr>><br>
<b>Sent:</b> Monday, 23 July 2018 15:40<br>
<b>To:</b> Mark Newton<br>
<b>Cc:</b> <a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a><br>
<b>Subject:</b> Re: [AusNOG] Issues receiving from TPG Mail servers.</font>
<div> </div>
</div>
</span>
<div>
<div class="m_3484836868209194876h5">
<div>
<div dir="ltr">@Michael - I agree that turning it off is the best way of solving it, the issue is we don't have the servers forcing TLS, that's TPG.<br>
<br>
@Mark - These are shared hosting servers, think cPanel & Plesk. The one server is both mail, and website. Which means that the server has websites that accept credit card payments, and therefore is subject to PCI. Any system that is on that server is required
to comply with PCI.
<div><br>
</div>
<div>If the server was website only, then I'd agree 100% that it would be out of scope for PCI, but since the same server runs both email and websites for shared hosting customers, it is in scope.</div>
<div><br>
</div>
<div>We have zero issue with any other MTA, it is only these TPG MTA's that are forcing both TLSv1.0 and an old cipher. If they either turned off TLS or upgraded to TLSv1.2 they would be up to spec.</div>
<div><br>
</div>
<div>But we either have to make the decision to block TPG from being able to send to the 100,000s of email accounts we have, or make it so that none of our customers servers are PCI compliant. I'd rather speak to TPG and work with them to fix the underlying
problem.</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_3484836868209194876m_-3072269293863601540gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">Regards,
<div><br>
</div>
<div>Bradley Silverman | VentraIP Australia<br>
<b>Technical Operations</b><br>
<br>
mobile. +61 418 641 103<br>
phone. +61 3 9013 8464<br>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Mon, Jul 23, 2018 at 3:34 PM, Mark Newton <span dir="ltr">
<<a href="mailto:newton@atdot.dotat.org" target="_blank">newton@atdot.dotat.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;line-break:after-white-space">But PCI Compliance only applies to the Cardholder Data Environment.
<div><br>
</div>
<div>Why on earth would you have a mail server in the Cardholder Data Environment?</div>
<div><br>
</div>
<div>And if it isn’t in the CDE: You can run whatever version of TLS you want, and it’s none of PCI’s business.</div>
<span class="m_3484836868209194876m_-3072269293863601540HOEnZb"><font color="#888888">
<div><br>
</div>
<div> - mark</div>
</font></span>
<div>
<div class="m_3484836868209194876m_-3072269293863601540h5">
<div><br>
</div>
<div><br>
<div><br>
<blockquote type="cite">
<div>On Jul 23, 2018, at 3:06 PM, Bradley Silverman <<a href="mailto:bsilverman@staff.ventraip.com" target="_blank">bsilverman@staff.ventraip.com</a><wbr>> wrote:</div>
<br class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999Apple-interchange-newline">
<div>
<div dir="ltr">Hi Matt,
<div><br>
</div>
<div>Really appreciate you sending me that email, I will definitely send an email through to there!<br>
<br>
@Mark Certainly not! PCI Compliance requires that TLSv1.0 be disabled on the server. Postifx/Exim/Dovecot are not exception to the rule, if we disable TLSv1.0 on the server and remove the weak cipher, then TPG's MTAs aren't able to send mail to us.</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">Regards,
<div><br>
</div>
<div>Bradley Silverman | VentraIP Australia<br>
<b>Technical Operations</b><br>
<br>
mobile. +61 418 641 103<br>
phone. +61 3 9013 8464<br>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Mon, Jul 23, 2018 at 2:48 PM, Mark Newton <span dir="ltr">
<<a href="mailto:newton@atdot.dotat.org" target="_blank">newton@atdot.dotat.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;line-break:after-white-space">You’re trying to exchange payment card information over email?<span class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999HOEnZb"><font color="#888888">
<div><br>
</div>
</font></span>
<div><span class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999HOEnZb"><font color="#888888"> - mark<br>
</font></span>
<div>
<div><br>
<blockquote type="cite">
<div>
<div class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999h5">
<div>On Jul 23, 2018, at 1:30 PM, Bradley Silverman <<a href="mailto:bsilverman@staff.ventraip.com" target="_blank">bsilverman@staff.ventraip.com</a><wbr>> wrote:</div>
<br class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999m_2119999520073362170Apple-interchange-newline">
</div>
</div>
<div>
<div>
<div class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999h5">
<div dir="ltr">
<div>Does anyone have a contact at TPG regarding their mail servers?</div>
<div><br>
</div>
<div>We are having issues with their mail servers using non-PCI compliant ciphers which is stopping our servers accepting mail from them.</div>
<div><br>
</div>
<br clear="all">
<div>
<div class="m_3484836868209194876m_-3072269293863601540m_-5051693789520965999m_2119999520073362170gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">Regards,
<div><br>
</div>
<div>Bradley Silverman | VentraIP Australia<br>
<b>Technical Operations</b><br>
<br>
mobile. +61 418 641 103<br>
phone. +61 3 9013 8464<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<span>______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br>
</span></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div></div></div>
</div>
<br>______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>